Last fourth of July, as fireworks burst across the night sky near the Lieber Correctional Institution in Ridgeville, S.C., convicted kidnapper Jimmy Causey tucked a lifelike dummy into his bed, sneaked out of his prison cell and completed a daring escape. It wasn’t until three days later, when Texas Rangers found Causey holed up 1,200 miles away, that authorities offered an explanation for how he had obtained the equipment for the breakout, including a pair of wire cutters used to snip through four fences that encircle the maximum security prison. “We believe a drone was used to fly in the tools that allowed him to escape,” Bryan Stirling, director of the South Carolina Department of Corrections, told reporters at a news conference.

A lengthy investigation confirmed that an accessory role was played by a small, off-the-shelf drone. And with that, law-enforcement and national security officials added “prison breaks” to the potential ill uses lurking in a technology widely available at retailers including Amazon and Walmart. Unlike military drones that can cost more than $15 million and look like small airplanes, mini quadcopters can be obtained for a few hundred dollars—and their capabilities are exciting the imaginations of bad guys. Criminals have used drones to drop drugs into prisons. Mexican smugglers have flown them above the border to spy on the movement of patrolling federal officers. ISIS used them to drop crude bombs on U.S. and allied forces in Iraq and Syria.

It is the widespread availability of commercial drones that poses the largest threat. Almost everybody who uses a drone in the U.S.—and the Federal Aviation Administration has licensed more than a million operators—flies by the rules. But not everyone, and perhaps the major lesson of 9/11 was to look for threats from unexpected places, especially overhead. Yet on drones, the federal response has been largely haphazard and behind the curve. The Pentagon is working to develop and deploy technologies to defeat drones and intends to spend $401.2 million on counter-drone initiatives this fiscal year, according to a study by the Center for the Study of the Drone at Bard College. “We know that terrorists are using drones overseas to advance plots and attacks, and we’ve already seen criminals use them along and within our borders for illicit purposes,” Department of Homeland Security Secretary Kirstjen Nielsen tells TIME. “We are working with Congress for the authorities needed to ensure we can better protect the American people against emerging drone threats.”

An Iraqi fighter spots a circling drone, unclear whether flown by an ally or foe, in Mosul in April 2017.

Lucien Lung—Riva Press/Redux

Part of the problem is that our laws and regulations aren’t designed for this new kind of threat. Current electronic eavesdropping laws preclude government officials from disabling drones midair with electromagnetic signals. A bipartisan group of Senators has introduced a bill that would give the Trump Administration the power to electronically jam drones that get too close to federal facilities; it is expected to pass before the end of the year. Agencies across government are now forbidden to identify and shoot down drones because of decades-old regulations that treat the robotic aircraft as if they were passenger jets.

Officials say they’re in a race against time. “It’s not if these devices will be weaponized in the homeland but when,” an Administration official told TIME. A White House fact sheet put out in support of the new measures says criminals could “drop explosive payloads, deliver harmful substances and conduct reconnaissance” using quadcopters. In November, authorities arrested a 55-year-old Sacramento man who flew a drone that dropped leaflets featuring a rant against television-news outlets inside Levi’s Stadium in Santa Clara, Calif., during an NFL game. No one was harmed, but officials with DHS and outside analysts took it as a warning: What if the drone’s payload were an explosive or a harmful chemical? He was cited for flying the drone in prohibited airspace, a misdemeanor.

One reason the U.S. government fears drone warfare is that it knows the power of remotely controlled air power. Since 2001, the CIA and Air Force have deployed the multimillion-dollar fixed wing MQ-1 Predator and MQ-9 Reaper drones, which are the size of small fighter jets and can deliver Hellfire missiles and 500-lb. bombs. These drones, mostly operated remotely from Nevada, have killed thousands of militants across the Middle East and the Horn of Africa. They have also been responsible for 751 to 1,555 civilian deaths, according to the London-based Bureau of Investigative Journalism, which tracks drone strike data.

The Obama Administration struggled to balance the strategic advantages of drones with the humanitarian costs. Over years of internal debate and external pressure, it developed a legal and policy framework underlying the controversial practice of targeted killing with drones. Critics, like the American Civil Liberties Union, said the extrajudicial system enabled a sitting President to be “judge, jury and executioner.” The Trump Administration has continued operating under the Obama rules. It has loosened constraints on who can be targeted on the basis of the threat they pose.

Most of the danger from the commercial drone boom here at home has been in the category of nuisance offenses. Under current law, hobbyists and commercial users must keep unmanned aircraft below 400 ft. and avoid flying within five miles of an airport to avoid endangering commercial aircraft. Even small drones could disable a passenger jet by getting sucked into and destroying a jet’s engine.

Still, recreational drone users often ignore the law. On Sept. 30, 2017, alone, there were eight dangerous drone incidents, according to the FAA: an airline pilot reported spotting a drone at 4,000 ft. as the passenger jet came in for a landing at O’Hare International Airport in Chicago; a pilot leaving Dallas/Fort Worth International Airport spotted a drone about 100 yd. off his left wing, hovering at 6,500 ft.; and others had close calls in Long Beach, Calif.; Burbank, Calif.; Newark, N.J.; McAlester, Okla.; Hollywood, Fla.; and San Antonio. In the first nine months of 2017 there were 1,696 drone sightings, according to the FAA’s most recent data, compared with 238 in all of 2014, the first year the data were tracked. The FAA expects the problem will get worse as the number of drones is estimated to triple to 3.5 million by 2021.

The risk of small drones’ flying into sensitive facilities first came into public view in 2015 when a hobbyist lost control of a drone that crashed on the southeast side of the 18-acre secure zone around White House grounds at about 3 a.m., triggering a Secret Service lockdown of the compound. Drones are off-limits in the airspace in the 15-mile radius around Washington and also over places like the Hoover Dam, the Statue of Liberty and Mount Rushmore. The drone that crashed near the White House, called a DJI Phantom, caused no damage, but it flew in undetected.

Iraqi Special Operations soldiers try to shoot down an Islamic State drone armed with explosives eastern Mosul in January 2017.

Ivor Prickett—The New York Times/Redux

That highlights one of the greatest challenges to tracking and countering drones deployed by bad actors. Existing radar systems are designed to detect much bigger threats. Most commercial drones are constructed of plastic and are difficult to spot electronically because they’re small, fly low to the ground and don’t carry a transponder to signal their positions. “It’s only a matter of time before the threat manifests in a violent way,” Defense Secretary James Mattis told a Senate panel in May.

The military has already faced the drone danger abroad. As American Special Operations commandos fought to retake the Iraqi city of Mosul from ISIS in the fall of 2016, they faced a threat that American ground forces hadn’t dealt with: attack from the air. Desperate to break the American-led siege of the city, ISIS militants sent fleets of small drones, often several at a time, carrying grenades and miniaturized explosives, scattering troops and driving them to seek cover. “At one point there were 12 killer bees, if you will, right overhead,” General Raymond Thomas, head of Special Operations Command, said last year, adding that the fighting nearly came to a “screeching halt.” The drones were too small for a fighter pilot or a tank gunner to pursue, which meant the troops’ only defense was to try to shoot the aircraft out of the sky with their rifles. Thomas said the small drones were the “most daunting” threat his commandos faced during the house-to-house campaign in Mosul. No U.S. casualties were reported. No American forces have been killed by an air attack since the Korean War.

America’s defensive tactics against drone strikes are rudimentary. ISIS has launched drone attacks on ground forces for the past two years. American commanders rushed electronic jammers to the war zone, but there were spotty examples of success. The Pentagon is working to develop two ways to combat terrorist drones: “hard kill” solutions that involve physically disabling drones, and “soft kill” ones that bring them down electronically. Much of the work falls to the military’s Joint Improvised Threat Defeat Organization, or JIDO, which was formed to combat roadside bombs during the wars in Iraq and Afghanistan. Lieut. General Michael Shields, JIDO’s director, says the goal isn’t to find a “silver bullet” to take drones down but to have an arsenal of both hard-kill and soft-kill capabilities.

JIDO has tried different approaches. It has developed small drones to patrol the skies and shoot a net to snag enemy drones. The so-called Negation of Improvised Non-State Joint Aerial threats system, or NINJA project, outfits drones with electronics that commandeer enemy drones by sending false GPS signals to trick the aircraft’s receivers. The Defense Advanced Research Projects Agency is developing a program that relies on a network of sensors to provide wide-area surveillance of all drones operating below 1,000 ft. in a city. DARPA has chosen defense giants Lockheed Martin and Raytheon, along with the University of Washington, to test their new technologies at various sites this year under contracts totaling $13 million.

There has been a boom market for counter-measures. Guard From Above, a Dutch company, trains eagles to intercept drones in midair. Britain-based OpenWorks Engineering designed the SkyWall bazooka that fires a net-carrying canister to capture drones and bring them to the ground. DroneShield, based in Sydney and Virginia, builds devices that use radar, acoustic and thermal sensors to detect drones in flight and send an alert if they fly near a stadium, prison or other restricted property. The company also makes jamming devices for roofs and porches that erect virtual walls drones can’t fly through.

A February study by Bard’s Center for the Study of the Drone identified 230 products designed by 155 manufacturers in 33 countries to subvert malicious drones. Back in South Carolina, where Jimmy Causey is back behind bars, law enforcement is already getting into the game. On May 24, corrections officials showed reporters a new tool to prevent contraband from entering the state’s 21 prison yards: small drones remotely piloted by two military veterans.